CWE-203 · Observable Discrepancy (page 5)
Page 5 of 8 — CVEs classified under CWE-203, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-46392 | Medium | 5.3 | 2022-12-15 | An issue was discovered in Mbed TLS before 2.28.2 and 3.x before 3.3.0. An adversary with access to precise enough information about memory accesses (typically… |
CVE-2022-3907 | High | 7.5 | 2022-12-05 | The Clerk WordPress plugin before 4.0.0 is affected by time-based attacks in the validation function for all API requests due to the usage of comparison operat… |
CVE-2022-4087 | Low | 2.6 | 2022-11-21 | A vulnerability was found in iPXE. It has been declared as problematic. This vulnerability affects the function tls_new_ciphertext of the file src/net/tls.c of… |
CVE-2022-45163 | Medium | 5.3 | 2022-11-18 | An information-disclosure vulnerability exists on select NXP devices when configured in Serial Download Protocol (SDP) mode: i.MX RT 1010, i.MX RT 1015, i.MX R… |
CVE-2022-41914 | Low | 3.7 | 2022-11-16 | Zulip is an open-source team collaboration tool. For organizations with System for Cross-domain Identity Management(SCIM) account management enabled, Zulip Ser… |
CVE-2022-20940 | Medium | 5.3 | 2022-11-15 | A vulnerability in the TLS handler of Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to gain access to sensitive… |
CVE-2020-35473 | Medium | 4.3 | 2022-11-08 | An information leakage vulnerability in the Bluetooth Low Energy advertisement scan response in Bluetooth Core Specifications 4.0 through 5.2, and extended sca… |
CVE-2021-45925 | Medium | 5.3 | 2022-10-24 | Observable discrepancies in the login process allow an attacker to guess legitimate user names registered in the BMC. This issue affects: Lanner Inc IAC-AST250… |
CVE-2022-40084 | Medium | 5.3 | 2022-10-20 | OpenCRX before v5.2.2 was discovered to be vulnerable to password enumeration due to the difference in error messages received during a password reset which co… |
CVE-2022-43412 | Medium | 5.3 | 2022-10-19 | Jenkins Generic Webhook Trigger Plugin 1.84.1 and earlier uses a non-constant time comparison function when checking whether the provided and expected webhook… |
CVE-2022-43411 | Medium | 5.3 | 2022-10-19 | Jenkins GitLab Plugin 1.5.35 and earlier uses a non-constant time comparison function when checking whether the provided and expected webhook token are equal… |
CVE-2021-36201 | Medium | 4.3 | 2022-10-11 | Under certain circumstances a CCURE Portal user could enumerate user accounts in CCURE 9000 version 2.90 and prior versions. |
CVE-2022-2891 | Medium | 5.9 | 2022-10-10 | The WP 2FA WordPress plugin before 2.3.0 uses comparison operators that don't mitigate time-based attacks, which could be abused to leak information about the… |
CVE-2022-40895 | Critical | 9.1 | 2022-10-06 | In certain Nedi products, a vulnerability in the web UI of NeDi login & Community login could allow an unauthenticated, remote attacker to affect the integrity… |
CVE-2022-35888 | Medium | 6.5 | 2022-09-29 | Ampere Altra and Ampere Altra Max devices through 2022-07-15 allow attacks via Hertzbleed, which is a power side-channel attack that extracts secret informatio… |
CVE-2022-32218 | Medium | 4.3 | 2022-09-23 | An information disclosure vulnerability exists in Rocket.Chat <v5, <v4.8.2 and <v4.7.5 due to the actionLinkHandler method was found to allow Message ID Enumer… |
CVE-2022-36105 | Medium | 5.3 | 2022-09-13 | TYPO3 is an open source PHP based web content management system released under the GNU GPL. It has been discovered that observing response time during user aut… |
CVE-2022-37146 | Medium | 5.3 | 2022-09-08 | The PlexTrac platform prior to version 1.28.0 allows for username enumeration via HTTP response times on invalid login attempts for users configured to use the… |
CVE-2022-1989 | Medium | 5.3 | 2022-08-23 | All CODESYS Visualization versions before V4.2.0.0 generate a login dialog vulnerable to information exposure allowing a remote, unauthenticated attacker to en… |
CVE-2022-37459 | High | 7.8 | 2022-08-17 | Ampere Altra devices before 1.08g and Ampere Altra Max devices before 2.05a allow attackers to control the predictions for return addresses and potentially hij… |
CVE-2022-2612 | Medium | 6.5 | 2022-08-12 | Side-channel information leakage in Keyboard input in Google Chrome prior to 104.0.5112.79 allowed a remote attacker who had compromised the renderer process t… |
CVE-2022-20324 | Medium | 5.5 | 2022-08-12 | In Framework, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This cou… |
CVE-2022-20320 | Low | 3.3 | 2022-08-12 | In ActivityManager, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. Th… |
CVE-2022-20318 | Low | 3.3 | 2022-08-12 | In PackageInstaller, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. T… |
CVE-2022-20316 | Low | 3.3 | 2022-08-12 | In ContentResolver, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. Th… |
CVE-2022-20309 | Low | 3.3 | 2022-08-12 | In PackageInstaller, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. T… |
CVE-2022-20307 | Low | 3.3 | 2022-08-12 | In AlarmManagerService, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure… |
CVE-2022-20304 | Medium | 5.5 | 2022-08-12 | In Content, there is a possible way to determinate the user's account due to side channel information disclosure. This could lead to local information disclosu… |
CVE-2022-20293 | Medium | 5.5 | 2022-08-12 | In LauncherApps, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This… |
CVE-2022-20291 | Medium | 5.5 | 2022-08-12 | In AppOpsService, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This… |
CVE-2022-20279 | Medium | 5.5 | 2022-08-12 | In DevicePolicyManager, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure… |
CVE-2022-20277 | Medium | 5.5 | 2022-08-12 | In DevicePolicyManager, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure… |
CVE-2022-20276 | Medium | 5.5 | 2022-08-12 | In DevicePolicyManager, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure… |
CVE-2022-20275 | Medium | 5.5 | 2022-08-12 | In DevicePolicyManager, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure… |
CVE-2022-20252 | Low | 3.3 | 2022-08-11 | In PackageManager, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. Thi… |
CVE-2022-20251 | Low | 3.3 | 2022-08-11 | In LocaleManager, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This… |
CVE-2022-20249 | Low | 3.3 | 2022-08-11 | In LocaleManager, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This… |
CVE-2022-20242 | Medium | 5.5 | 2022-08-11 | In Telephony, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This cou… |
CVE-2021-0975 | Medium | 5.5 | 2022-08-11 | In USB Manager, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This c… |
CVE-2021-46778 | Medium | 5.6 | 2022-08-10 | Execution unit scheduler contention may lead to a side channel vulnerability found on AMD CPU microarchitectures codenamed “Zen 1”, “Zen 2” and “Zen 3” that us… |
CVE-2022-20866 | High | 7.4 | 2022-08-10 | A vulnerability in the handling of RSA keys on devices running Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Softwa… |
CVE-2022-34704 | Medium | 4.7 | 2022-08-09 | Windows Defender Credential Guard Information Disclosure Vulnerability |
CVE-2022-24912 | High | 7.5 | 2022-07-29 | The package github.com/runatlantis/atlantis/server/controllers/events before 0.19.7 are vulnerable to Timing Attack in the webhook event validator code, which… |
CVE-2022-36885 | Medium | 5.3 | 2022-07-27 | Jenkins GitHub Plugin 1.34.4 and earlier uses a non-constant time comparison function when checking whether the provided and computed webhook signatures are eq… |
CVE-2022-1146 | Medium | 6.5 | 2022-07-23 | Inappropriate implementation in Resource Timing in Google Chrome prior to 100.0.4896.60 allowed a remote attacker to leak cross-origin data via a crafted HTML… |
CVE-2022-1139 | Medium | 6.5 | 2022-07-23 | Inappropriate implementation in Background Fetch API in Google Chrome prior to 100.0.4896.60 allowed a remote attacker to leak cross-origin data via a crafted… |
CVE-2022-32425 | Medium | 5.3 | 2022-07-14 | The login function of Mealie v1.0.0beta-2 allows attackers to enumerate existing usernames by timing the server's response time. |
CVE-2022-31142 | High | 7.5 | 2022-07-14 | @fastify/bearer-auth is a Fastify plugin to require bearer Authorization headers. @fastify/bearer-auth prior to versions 7.0.2 and 8.0.1 does not securely use… |
CVE-2022-20752 | Medium | 5.3 | 2022-07-06 | A vulnerability in Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), and Cis… |
CVE-2021-41634 | Medium | 5.3 | 2022-06-24 | A user enumeration vulnerability in MELAG FTP Server 2.2.0.4 allows an attacker to identify valid FTP usernames. |
CVE-2022-34174 | High | 7.5 | 2022-06-23 | In Jenkins 2.355 and earlier, LTS 2.332.3 and earlier, an observable timing discrepancy on the login form allows distinguishing between login attempts with an… |
CVE-2022-24436 | Medium | 6.5 | 2022-06-15 | Observable behavioral in power management throttling for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure… |
CVE-2022-23823 | Medium | 6.5 | 2022-06-15 | A potential vulnerability in some AMD processors using frequency scaling may allow an authenticated attacker to execute a timing attack to potentially enable i… |
CVE-2022-27221 | Medium | 5.9 | 2022-06-14 | A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1). An attacker in machine-in-the-middle could obtain plaintext secret v… |
CVE-2022-0823 | Medium | 6.2 | 2022-06-09 | An improper control of interaction frequency vulnerability in Zyxel GS1200 series switches could allow a local attacker to guess the password by using a timing… |
CVE-2022-32273 | Medium | 4.3 | 2022-06-08 | As a result of an observable discrepancy in returned messages, OPSWAT MetaDefender Core (MDCore) before 5.1.2 could allow an authenticated user to enumerate fi… |
CVE-2022-29185 | Medium | 4.2 | 2022-05-20 | totp-rs is a Rust library that permits the creation of 2FA authentification tokens per time-based one-time password (TOTP). Prior to version 1.1.0, token compa… |
CVE-2022-24043 | Medium | 5.3 | 2022-05-20 | A vulnerability has been identified in Desigo DXR2 (All versions < V01.21.142.5-22), Desigo PXC3 (All versions < V01.21.142.4-18), Desigo PXC4 (All versions <… |
CVE-2021-33149 | Medium | 5.5 | 2022-05-12 | Observable behavioral discrepancy in some Intel(R) Processors may allow an authorized user to potentially enable information disclosure via local access. |
CVE-2021-46744 | Medium | 6.5 | 2022-05-11 | An attacker with access to a malicious hypervisor may be able to infer data values used in a SEV guest on AMD CPUs by monitoring ciphertext values over time. |
CVE-2021-33845 | Medium | 5.3 | 2022-05-06 | The Splunk Enterprise REST API allows enumeration of usernames via the lockout error message. The potential vulnerability impacts Splunk Enterprise instances b… |
CVE-2022-1318 | Medium | 6.2 | 2022-04-20 | Hills ComNav version 3002-19 suffers from a weak communication channel. Traffic across the local network for the configuration pages can be viewed by a malicio… |
CVE-2022-27814 | Low | 3.3 | 2022-04-14 | SWHKD 1.1.5 allows arbitrary file-existence tests via the -c option. |
CVE-2022-22356 | Medium | 6.5 | 2022-04-05 | IBM MQ Appliance 9.2 CD and 9.2 LTS could allow an attacker to enumerate account credentials due to an observable discrepancy in valid and invalid login attemp… |
CVE-2021-39791 | Medium | 5.5 | 2022-03-30 | In WallpaperManagerService, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclo… |
CVE-2021-39788 | Medium | 5.5 | 2022-03-30 | In TelecomManager, there is a possible way to check if a particular self managed phone account was registered on the device due to side channel information dis… |
CVE-2021-39775 | Medium | 5.5 | 2022-03-30 | In People, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could… |
CVE-2021-39773 | Medium | 5.5 | 2022-03-30 | In VpnManagerService, there is a possible disclosure of installed VPN packages due to side channel information disclosure. This could lead to local information… |
CVE-2021-39766 | Medium | 5.5 | 2022-03-30 | In Settings, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This coul… |
CVE-2021-39761 | Medium | 5.5 | 2022-03-30 | In Media, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could l… |
CVE-2021-39760 | Medium | 5.5 | 2022-03-30 | In AudioService, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This… |
CVE-2021-39756 | Medium | 5.5 | 2022-03-30 | In Framework, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This cou… |
CVE-2021-39755 | Medium | 5.5 | 2022-03-30 | In DevicePolicyManager, there is a possible way to reveal the existence of an installed package without proper query permissions due to side channel informatio… |
CVE-2021-39754 | Medium | 5.5 | 2022-03-30 | In ContextImpl, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This c… |
CVE-2021-39745 | Medium | 5.5 | 2022-03-30 | In DevicePolicyManager, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure… |
CVE-2021-39744 | Medium | 5.5 | 2022-03-30 | In DevicePolicyManager, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure… |
CVE-2022-24784 | Low | 3.7 | 2022-03-25 | Statamic is a Laravel and Git powered CMS. Before versions 3.2.39 and 3.3.2, it is possible to confirm a single character of a user's password hash using a spe… |
CVE-2021-44421 | Medium | 5.5 | 2022-03-10 | The pointer-validation logic in util/mem_util.rs in Occlum before 0.26.0 for Intel SGX acts as a confused deputy that allows a local attacker to access unautho… |
CVE-2020-36517 | High | 7.5 | 2022-03-10 | An information leak in Nabu Casa Home Assistant Operating System and Home Assistant Supervised 2022.03 allows a DNS operator to gain knowledge about internal n… |
CVE-2021-42016 | High | 7.5 | 2022-03-08 | A vulnerability has been identified in RUGGEDCOM i800, RUGGEDCOM i801, RUGGEDCOM i802, RUGGEDCOM i803, RUGGEDCOM M2100, RUGGEDCOM M2100F, RUGGEDCOM M2200, RUGG… |
CVE-2022-0564 | Medium | 5.3 | 2022-02-21 | A vulnerability in Qlik Sense Enterprise on Windows could allow an remote attacker to enumerate domain user accounts. An attacker could exploit this vulnerabil… |
CVE-2022-23643 | Medium | 6.5 | 2022-02-15 | Sourcegraph is a code search and navigation engine. Sourcegraph versions 3.35 and 3.36 reintroduced a previously fixed side-channel vulnerabilitity in the Code… |
CVE-2022-0569 | Medium | 5.3 | 2022-02-14 | Observable Discrepancy in Packagist snipe/snipe-it prior to v5.3.9. |
CVE-2021-0524 | Medium | 5.5 | 2022-02-11 | In isServiceDistractionOptimized of CarPackageManagerService.java, there is a possible disclosure of installed packages due to side channel information disclos… |
CVE-2021-45901 | Medium | 5.3 | 2022-02-10 | The password-reset form in ServiceNow Orlando provides different responses to invalid authentication attempts depending on whether the username exists. |
CVE-2021-39021 | Medium | 5.3 | 2022-02-02 | IBM Guardium Data Encryption (GDE) 5.0.0.2 behaves differently or sends different responses under different circumstances in a way that is observable to an una… |
CVE-2022-21659 | Medium | 5.3 | 2022-01-31 | Flask-AppBuilder is an application development framework, built on top of the Flask web framework. In affected versions there exists a user enumeration vulnera… |
CVE-2022-24032 | Medium | 5.3 | 2022-01-30 | Adenza AxiomSL ControllerView through 10.8.1 is vulnerable to user enumeration. An attacker can identify valid usernames on the platform because a failed login… |
CVE-2019-25056 | Medium | 5.3 | 2022-01-26 | In Bromite through 78.0.3904.130, there are adblock rules in the release APK; therefore, probing which resources are blocked and which aren't can identify the… |
CVE-2022-23304 | Critical | 9.8 | 2022-01-17 | The implementations of EAP-pwd in hostapd before 2.10 and wpa_supplicant before 2.10 are vulnerable to side-channel attacks as a result of cache access pattern… |
CVE-2022-23303 | Critical | 9.8 | 2022-01-17 | The implementations of SAE in hostapd before 2.10 and wpa_supplicant before 2.10 are vulnerable to side channel attacks as a result of cache access patterns. N… |
CVE-2022-23106 | Medium | 5.3 | 2022-01-12 | Jenkins Configuration as Code Plugin 1.55 and earlier used a non-constant time comparison function when validating an authentication token allowing attackers t… |
CVE-2022-22120 | Medium | 5.3 | 2022-01-10 | In NocoDB, versions 0.9 to 0.83.8 are vulnerable to Observable Discrepancy in the password-reset feature. When requesting a password reset for a given email ad… |
CVE-2021-20147 | Medium | 5.3 | 2022-01-03 | ManageEngine ADSelfService Plus below build 6116 contains an observable response discrepancy in the UMCP operation of the ChangePasswordAPI. This allows an una… |
CVE-2020-35398 | Medium | 5.3 | 2021-12-23 | An issue was discovered in UTI Mutual fund Android application 5.4.18 and prior, allows attackers to brute force enumeration of usernames determined by the err… |
CVE-2021-20049 | High | 7.5 | 2021-12-23 | A vulnerability in SonicWall SMA100 password change API allows a remote unauthenticated attacker to perform SMA100 username enumeration based on the server res… |
CVE-2021-38009 | Medium | 6.5 | 2021-12-23 | Inappropriate implementation in cache in Google Chrome prior to 96.0.4664.45 allowed a remote attacker to leak cross-origin data via a crafted HTML page. |
CVE-2021-44876 | Medium | 5.3 | 2021-12-21 | Dalmark Systems Systeam 2.22.8 build 1724 is vulnerable to User enumeration. The Systeam application is an ERP system that uses a mixed architecture based on S… |
CVE-2021-44875 | Medium | 5.3 | 2021-12-21 | Dalmark Systems Systeam 2.22.8 build 1724 is vulnerable to User enumeration. The Systeam application is an ERP system that uses a mixed architecture based on S… |
CVE-2021-44554 | Medium | 5.3 | 2021-12-20 | Thinfinity VirtualUI before 3.0 allows a malicious actor to enumerate users registered in the OS (Windows) through the /changePassword URI. By accessing the ve… |